August 2025 Summaries

Pulumi CLI v3.192.0 introduces new commands, pulumi state taint and pulumi state untaint, designed to facilitate resource management by marking resources for replacement when dealing with infrastructure issues like corrupted disks or expired certificates. These commands are especially useful in environments where direct cloud access is restricted, allowing changes to occur through CI/CD pipelines without emergency access requests. The taint command marks a resource for replacement, while the untaint command cancels this action, offering flexibility to preview changes before they are applied. This feature, which emerged from user feedback, provides the same functionality as the pulumi up --replace command but allows for upfront resource marking and integration into automated workflows, making it ideal for situations where arranging replacement flags in CI/CD would be cumbersome. Users are encouraged to try this feature in a development stack to familiarize themselves with the process, with further details available in the v3.192.0 release notes.

Pulumi has introduced a new feature that automatically generates multi-language API documentation in its Private Registry, enhancing the discoverability and usability of infrastructure components. This innovation addresses the challenge platform teams face in making their reusable infrastructure components easily accessible and understandable to development teams. By automatically creating rich, interactive API documentation when components are published, Pulumi ensures that developers across different programming languages—from Python to TypeScript, Go, C#, Java, and YAML—can easily access and understand component capabilities and configurations. This feature transforms the private registry into a comprehensive catalog, facilitating quicker component discovery and adoption, and ultimately accelerating infrastructure development within organizations. Pulumi's commitment to improving infrastructure workflows is further demonstrated by this initiative, which aims to streamline the component lifecycle and promote robust, secure, and scalable infrastructure patterns.

Azure Resource Manager (ARM) templates, often criticized for their complexity and limitations, face challenges such as lengthy, error-prone deployments and a lack of support for certain key services. In contrast, Pulumi offers a more efficient alternative by allowing Azure infrastructure to be defined using familiar programming languages like C#, Python, TypeScript, or Go, providing benefits like type safety, full IDE support, and easier testing and reuse. Pulumi integrates seamlessly with existing .NET tooling, supports a wide range of Azure services, and facilitates infrastructure management akin to software engineering, promoting modular, testable, and scalable solutions. This makes Pulumi a compelling choice for organizations already utilizing C# and .NET, especially with its capability to share libraries and logic between services and integrate with platforms like Azure DevOps and GitHub Actions.

This article is the second in a series on Internal Developer Platform (IDP) best practices, focusing on creating "golden paths"—pre-architected, reusable infrastructure patterns designed to standardize and accelerate cloud development. With modern cloud platforms offering an overwhelming array of services and tools, developers often face decision fatigue and inconsistent implementations. Golden paths address these challenges by providing ready-to-use, production-grade infrastructure that encapsulates an organization's best practices, security policies, and operational standards. Utilizing Pulumi's core constructs of Components and Templates, the article guides readers on building these pathways, enabling infrastructure abstractions that are written once and shared across teams, significantly reducing setup time. The article further emphasizes the layering model for IDPs, detailing how to transition from building reusable infrastructure components to developing comprehensive golden path templates that facilitate safe and consistent delivery, ultimately transforming IDPs into a system of self-service, speed, and stability. By illustrating the creation of a Go microservice golden path, the text showcases how to integrate application scaffolding, infrastructure deployment, CI/CD pipeline configuration, and security controls to enhance developer efficiency and application reliability.

The text outlines the strategic foundations and best practices for designing an Internal Developer Platform (IDP) using Pulumi, emphasizing the balance between empowering developers and maintaining governance, security, and operational control. It introduces a layered approach consisting of the Infrastructure Layer, Platform Layer, and Developer Experience Layer, each serving different purposes in transforming raw cloud infrastructure into reusable components and templates that developers can easily use. The guide highlights the importance of abstractions, blueprints, workflows, security guardrails, and self-service as core components of a successful IDP, which enable faster infrastructure provisioning, improved developer productivity, and enhanced security while reducing operational overhead. It stresses the significance of understanding different user personas and providing appropriate interfaces for various consumption patterns, supported by a private registry to ensure discoverability and lifecycle management of components and templates. Ultimately, the text argues that a well-designed IDP serves as a strategic foundation that accelerates business outcomes by enabling rapid innovation while maintaining control.

Infrastructure bottlenecks and compliance issues are significant challenges for developers, and while platform engineering aims to address these, many platforms fail to have a real impact due to neglecting infrastructure as a foundational concern. The text compares Backstage, a portal-first platform developed by Spotify focused on service catalogs and documentation, with Pulumi IDP, an infrastructure-first internal developer platform that prioritizes governance, cost control, and security from the outset. Backstage requires a lengthy setup and significant maintenance, making it suitable for organizations with existing robust infrastructure tools, whereas Pulumi IDP offers rapid deployment with minimal ongoing overhead, ideal for infrastructure-intensive environments. The article emphasizes that the success of platform engineering depends on treating infrastructure as a first-class concern, rather than an afterthought, and suggests that Pulumi IDP’s infrastructure-first approach provides a scalable and cost-efficient solution. Additionally, hybrid solutions are feasible, as Pulumi provides a Backstage plugin to combine portal features with infrastructure capabilities.

Pulumi AWS Provider 7.0 introduces enhanced capabilities for managing AWS infrastructure as code, featuring improvements such as support for multi-region deployments with a single provider configuration and the introduction of IAM role chaining for secure workflows. This major release includes breaking changes and improvements from upstream Terraform versions 6.0.0 to 6.3.0, and it marks the unification of S3 Bucket resources, with the existing Bucket and BucketV2 resources now both representing the latest version of the upstream Terraform S3 Bucket resource. The update simplifies infrastructure management by reducing memory usage through single provider configurations, allowing specification of AWS regions at the resource level, and streamlining cross-region VPC peering. Additionally, the transition to the latest S3 Bucket implementations means the deprecation of BucketV2 and its eventual removal in version 8.0, accompanied by new configuration resources that replace V2 counterparts. Pulumi AWS 7.0 supports a wide range of programming languages, including TypeScript, Python, Go, C#, Java, and YAML, and provides comprehensive documentation and guides for migration and getting started.

Pulumi ESC has introduced a new feature called Approvals to enhance governance and oversight in environment configuration workflows, allowing organizations to enforce change management without slowing down teams. Approvals require explicit review and sign-off before applying changes to ESC-managed environments, similar to code review workflows, ensuring that proposed changes undergo a structured review process. This feature helps manage environment configurations and secrets across various services, reducing the risk of accidental or unreviewed changes. Approvals create an auditable record of who approved changes, which is crucial for teams with strict change-management processes and compliance requirements. The feature is integrated into the Pulumi Cloud console, ESC CLI, SDK, and Visual Studio Code Extension, allowing seamless collaboration while maintaining security and accountability. This development is part of Pulumi's broader effort to extend approval workflows across the software delivery lifecycle, aiming to balance speed with security and compliance.